A malicious peer marks a file entry FLAG_HLINKED even though hard links were
not negotiated (-H absent), which the receiver accepted. (Accepting the flag
on a DIRECTORY entry was a second invalid form closed by the same fix; the
demonstrated write is on a regular file.) The HLINK_BUMP()/OPT_EXTRA offset computed for such an
entry then places attacker-supplied bytes just outside the pool entry that was
allocated for it.
Reaching the write requires protocol-30 incremental recursion, a regular file,
--checksum in use, and -H absent: the extra hard-link slots are reserved only
when preserve_hard_links is set, and the out-of-bounds write lands through
F_SUM(file).
Fixed by refusing FLAG_HLINKED when hard links are not in use and refusing it
on a directory entry.
Affected: 3.0.0 through 3.4.4
Fixed in: 3.5.0 (part of the malicious-peer robustness work)
Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)
Test: proto-hlink-flag-oob
gregkh Finder
A malicious peer marks a file entry FLAG_HLINKED even though hard links were
not negotiated (-H absent), which the receiver accepted. (Accepting the flag
on a DIRECTORY entry was a second invalid form closed by the same fix; the
demonstrated write is on a regular file.) The HLINK_BUMP()/OPT_EXTRA offset computed for such an
entry then places attacker-supplied bytes just outside the pool entry that was
allocated for it.
Reaching the write requires protocol-30 incremental recursion, a regular file,
--checksum in use, and -H absent: the extra hard-link slots are reserved only
when preserve_hard_links is set, and the out-of-bounds write lands through
F_SUM(file).
Fixed by refusing FLAG_HLINKED when hard links are not in use and refusing it
on a directory entry.
Affected: 3.0.0 through 3.4.4
Fixed in: 3.5.0 (part of the malicious-peer robustness work)
Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)
Test: proto-hlink-flag-oob